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HUMAN FACTORS CONSIDERATIONS IN THE POTENTIAL FOR USING ELEVATORS 
FOR FIRE EVACUATION OF FAA AIR TRAFFIC CONTROL TOWERS 


I. INTRODUCTION 


A. Purpose of this study. This study is part of a wider investigation of the feasibility of using 
elevators for emergency egress in Federal Aviation Administration (FAA) air traffic control towers. 
This study is also part of an ongoing effort to examine those factors that will allow the design, 
installation and maintenance of elevators that can be safely used to evacuate occupants during fire 
emergencies from all types of occupancies. Elevator use for emergency egress is a complicated 
topic, and the specific issues that must be dealt with vary considerably depending on the specific 
application. This is especially true where human factors are concerned, because the characteristics 
of the individual building occupants vary so widely. Organizational attributes differ also. The focus 
of this report, human factors considerations for using elevators for evacuating aviation control 
towers, is narrow. In order to be safe for fire evacuation, elevators must be protected from fire, 
heat, smoke, water, loss of electric power, and loss of elevator machine room cooling. These 
engineering issues and an overview of human considerations about elevator fire evacuation are 
presented by Klote, Levin and Groner (1994). 


B. Related study. A more broad-ranging report was written by the present authors titled Human 
Factors Consideration in the Potential for Using Elevators in Building Emergency Evacuation Plans 
(NIST-GCR-92-615). This study presented a detailed discussion of many issues of concern in 
elevator evacuation, and did not focus on any particular type of occupancy or building. The study 
presented herein examines the same issues as they pertain to aviation control towers. 


C. Visits to towers. The authors visited several air traffic control towers. As discussed in the next 
section of this report, the towers are very unusual buildings. For this reason, it was imperative to 
conduct on-site examinations of a representative sample of towers. In all, 13 towers were visited 
by one or more members of the project team. These towers were selected to provide examples of 
all the principal architectural designs used by the Federal Aviation Administration, as well as some 
"non-standard" types which are not replicated elsewhere. The project team was comprised of the 
two authors of this report, both human factors specialists, and the scientist/engineer from the 
National Institute of Standards and Technology, Dr. John Klote, who is the project director for this 
and the other studies related to fire safety and elevator use. 


The visits included a tour of each facility and interviews with a manager and at least two air traffic 
controllers. In most towers we also interviewed FAA employees concerned with maintaining the 
building and the equipment. These brief interviews (typically around 15 minutes) were required 
to solicit opinions about the willingness of building occupants to use elevators in the event of a fire 
emergency, as well as various other topics. Air traffic controllers will evacuate only after alerting 
the pilots they are directing and, normally, they will evacuate only after arranging for other 
controllers to assume their more critical functions. During the interviews we attempted to learn 
how long the controllers might take before they would leave the cab so we might better understand 
the potential queuing at the elevators and possible effects on the fire safety plan of any possible 
substantial delays in actually evacuating. 


Table 1. FAA Air Traffic Control Towers Visited 


Location 


Scottsdale, SDL Leo Daly Low Klote, Levin & Groner 
Andrews AFB, ADW Klote, Levin & Groner 


Washington/Dulles, IAD Klote, Levin & Groner 
Detroit/Metro-Wayne, DTW Leo Daly Major Klote, Levin & Groner 
Baltimore/Wash, BWI 


Metro Oakland, OAK 
Bates Field (Mobile), MOB 
Sarasota/Bradenton, SRO 
Ontario Int, ONT 
Van Nuys, VNY 
Philadelphia, PHL 
Atlantic City, ACY 
Tetersboro, TEB favco | KloteeLevin | eb 2 


D. Importance of a systems approach to the evaluation of safe elevator use. Human behavior can 


not be "engineered-out" of any system designed to protect people from fires. Even the most 
reliable hardware system, for example, fire sprinklers, inevitably depends on people to maintain 
them and to avoid compromising their integrity. Similarly, the behavior of people always depends 
on the settings in which they are located, including the fire protection features and physical layout 
of buildings. This essential truth, the mutual dependence of human behavior and building features, 
was repeatedly illustrated during our visits to the towers. 


This study specifically involves an application of the Life Safety Systems approach. Essentially, this 
heuristic approach uses the concept of life safety strategies (the basic plans that people follow 
during emergencies) as a means of integrating all the various components, human actions and 
hardware, that comprise an elevator evacuation system. For a detailed explanation of this 
approach, see Groner and Levin, 1992. 


E. Distinctiveness of air traffic control towers. Consistent with the life safety systems approach, 
the design of any elevator evacuation system must be tailored to the specific application. This is 
especially true for air traftic control towers, in as much as they are very distinctive from other 
occupancies. 


Air traffic control towers are tall and narrow. They are tall because the "cab" needs to be high 


enough that the air traffic controllers can view any portion of the airport or the air space where 
there might be airplanes with which they are in communication. Narrow towers are less expensive 
to build, are less likely to contain extraneous activities (that could lead to a fire requiring an 
evacuation) and are unlikely to obstruct the controllers’ view of the runways. The limited area on 
each floor discourages installing two stairways and precludes installing two stairways that are 
remote from the standpoint of providing independent access to the exit stairways. (Once in the 
Stairways the routes could be adequately independent.) 


The unusual geometry of air traffic control towers has created a unique emergency egress problem. 
Most current air traffic control towers contain both a single stairs and a single elevator serving the 
upper portion of the tower. The elevator is used to avoid using a long stairway to travel to and 
from a location below the work site in the cab. (The elevator does not serve the cab itself. The 
cab can be reached only by a single stairway.) The stairs are needed for emergency egress and as 
a backup when the elevator is not in operation due to routine maintenance or unanticipated 
problems. 


This unusual configuration has created an interesting problem as regards emergency egress. The 
presently installed elevators in the towers, as well as current elevators in other buildings, are 
unacceptable as a means of leaving the building in a fire emergency. The towers are left, therefore, 
with only a single means of emergency egress. Having only one means of egress, some towers 
currently fail to meet a safety specification in a code used by the Federal government as described 
below.’ 


The Life Safety Code, a model code whose development is administered by the National Fire 
Protection Association, is used by the Federal Occupational Safety and Health Administration to 
determine whether Federal agencies meet minimum levels of safety for their employees. Section 
5.4 of the Code requires that there be at least two means of egress from any story of most 
buildings, and specifically disqualifies elevators as a means of egress. 


F. Relationship of occupancy loads to Code requirements. The low occupancy loads in most 
towers help them to meet Code requirements. Section 30-2.4 of the 1991 and 1994 editions of the 


Life Safety Code provides an exception to the two means of egress requirement for certain "towers." 
Among other requirements, the exception to the two means of egress requirement can be used 
when the tower is occupied by fewer than 25 persons. (In earlier editions, the exception applied 
when each of the floors are occupied by tewer than 25 persons.) Most of the towers we visited 
easily fall below this occupancy limit. 


However a few of the towers we studied had more than 24 occupants at some time during a typical 
day. These towers are older nonstandard designs where the tower is not devoted exclusively to air 


’ Although the towers fail to meet a specification in the Life Safety Code, this does not mean 
that the towers fail to meet the requirements of the Code. The Life Safety Code permits the use 
of alternate means of achieving the desired level of safety. It is beyond the scope of this report to 
address whether current air traffic control towers meet or fail to meet the requirements of the 
Code. 


traffic control from the cab. In one of these towers, the TRACON’ and administrative offices are 
located in the tower. In another, the local port authority maintains administrative offices within 
the tower and there is a public bar/lounge in the tower as well. This latter tower is scheduled to 
be replaced in a few years. Further, it is our understanding that the newer standard designs for 
towers largely restrict such extraneous functions in the towers. Nonetheless, some of the towers 
that we visited did not meet all the specifications in the Life Safety Code. This study is directed 
at studying the possibility of qualifying the elevator as a second means of egress, both for the 
purpose of satisfying Code requirements, and as an enhancement to the overall safety of tower 
occupants. 


As stated above, the Life Safety Code [Section 30-2.3, Exception No. 3(b)] has an exception that 
allows only one means of egress in towers occupied by fewer than 25 persons. This exception 
applies only when all the people in the tower are "able-bodied". Despite the ambiguity inherent 
in the choice of wording, the intent is to preclude the presence of people who cannot descend 
stairs, and, therefore, who would not have any safe means of egress that they could use without 
assistance in the event of a fire emergency.’ Currently, towers are occupied only by persons who 
are able to use stairs. A potential benefit to qualifying elevators as a second means of egress is that 
a wider range of persons could work in the tower without violating this important exception in the 
Code. 


Historically, only people with normal mobility have been hired and trained as air traffic controllers. 
The problems that people with disabilities would have in satisfactorily performing the tasks of the 
job are beyond the scope of this study. However, this policy is being reevaluated within FAA. 


The current absence of persons with such mobility-impairments is especially important because 
much of the impetus towards using elevators for emergency egress in other occupancies has come 
from the problems of evacuating people with disabilities during fires. However, the ability to safely 
evacuate towers using elevators would remove one barrier to the presence of people with mobility 
disabilities in the towers. Procedural changes, related to fire safety, that would be necessitated by 
their presence are explored later in the section covering life safety strategies. 


G. Tower visitors. For the most part, visitors are not found in aviation control towers. In 
particular, security is provided to prevent unauthorized persons from entering FAA controlled 
portions of the tower. (In one tower a security person, who was not a FAA employee, was in the 
tower observing the loading of a plane as part of his security function. Also, the authors of this 
report were "visitors" when we conducted our study.) In one of the older non-standard towers, a 
bar/lounge area was located in the tower. However, access to this area was provided by a dedicated 


*TRACON contains a group of air traffic controller controlling airspace that is not controlled 
by controllers in the cab of the tower. 


* Apart from Life Safety Code requirements, persons with stair-use related disabilities are 
prevented from working in the cabs of towers because, to date, the only access to the cabs is via 
Stairs. The elevators in control towers travel only to a level below the cab. A typical elevator going 
to the cab might block the required views of runways or planes in the air and would use a large 
percentage of the floor space in the cab. See Klote, Levin, and Groner (1994) for discussion of 
possible elevators that might serve the cab. 


elevator. The FAA elevator did not serve this floor. As we discussed in our prior reports (Groner 
and Levin, 1992; and Levin and Groner, 1992) special measures need to be taken to assist visitors 
in following the procedures designed to enable safe use of elevators, especially when those visitors 
are not accompanied by permanent building occupants. However, the absence of unaccompanied 
visitors greatly simplities the organizational aspects of evacuating by elevators. 


H. Single tenant. For the most part, the towers were the exclusive domain of the FAA. The 
presence of a single "tenant" greatly simplifies the management of evacuations and the training of 
occupants. One of the visited towers was a notable exception. This tower included numerous 
administrative offices and equipment rooms used by the local port authority. As such, planning, 
coordinating, and executing an emergency evacuation would be more difficult. For example, the 
port authority maintained the facility. The FAA representatives interviewed by the visiting project 
team member were unfamiliar with the fire alarm system. They did not know where the 
annunciator was located, and they were uncertain as to who they needed to contact in the port 
authority. When asked about the alarm system, the facilities manager said that he too was 
unfamiliar with the system, and we were unable to contact the port authority employee with the 
needed information. This type of coordination problem was not evident in towers under the 
exclusive control of a single "tenant", ie. the FAA. 


II. DEVELOPING AND INSTALLING THE EMERGENCY PLAN 


A. Life safety strategies. A building emergency system based on the life safety systems approach 
is based on a set of strategies, all with the objective of keeping building occupants away from smoke 


and fire conditions. The set of strategies--called life safety strategies--is the starting point. Systems 
components are discussed in relation to their contributions to completing a strategy. 


We sometimes refer to a "set of strategies," because there may be a separate strategy for 
each floor or group of floors and there may be backup strategies. 


A "life safety strategy” has been defined as "a general plan for protecting building occupants 
from being exposed to the flames and smoke of a fire." (Groner, 1985). A strategy can be 
expressed as a short statement that describes the fundamental actions that building occupants 
follow in a fire emergency. A few examples are: "Everyone in the building leaves using the nearest 
exit," and "The alarm alerts building occupants that they may need to evacuate. Floor wardens are 
notified when their respective floors should evacuate, and which stairway should be used." (The 
above three paragraphs are taken from Groner and Levin, 1992.) 


Life Safety Strategies are heuristic devices that integrate all the disparate components of an 
elevator evacuation system. Using the elevator to evacuate aviation control towers is fairly 
straightforward, without the complexities of evacuating large numbers of people on many floors 
from other occupancies such as high rise office buildings. In these more complex settings, different 
strategies are needed depending on such factors as occupants’ location in the building relative to 
the fire. However, if a tower were to have a fire safe elevator, the following basic life safety 
strategy would seem appropriate for ambulatory occupants: 


Use stairs to leave tower. If stairs unavailable, then use elevator. 


As discussed earlier, the installation of elevators that can be used safely during fire emergencies 
would remove one impediment to the presence of persons who cannot use stairs. For such 
mobility-impaired occupants, the following strategy would be more appropriate: 


Use elevator to leave the tower. If elevator is unavailable, then summon assistance to 
descend stairs. 


These two strategies then become the basis for developing the entire elevator evacuation system. 
The components directly concerning fire protection engineering are discussed in the companion 
report (Klote, Levin and Groner, 1994.) This report focuses specifically on the organizational and 
human factors that will determine whether these basic strategies can be successfully implemented 
during an emergency. 


B. Suggestions for the "written" plan. Written plans are generally created to serve two, often 
incompatible, goals. First, they provide information to building occupants about the appropriate 
procedures to be followed during an emergency, what we call an "action document." Second, they 
provide evidence to organizational and regulatory authorities that an appropriate plan has in fact 
been developed--what we call a "compliance document." The two goals tend to be incompatible: 
the first goal encourages brevity, clarity, and the absence of information that is non-essential to the 
reader; the second emphasizes comprehensiveness to ensure that all the elements of the plan have 
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been incorporated. A possible resolution of this conflict might be to prepare two documents, one 
directed at each goal. 


During our visits we collected the portions of tower emergency plans that concerned fire 
evacuations. For the most part, these plans were principally intended to serve as compliance 
documents. Fire emergency procedures were a small portion of a larger document concerned with 
all types of emergencies. The fire emergency portions were typically brief, reflecting the relatively 
straightforward nature of such an emergency in these facilities. 


In general, we recommend that separate action documents be developed for different occupant 
groups to better avoid the common problem of masking critical information by including 
information that is irrelevant to the actions. If there are different plans for different parts of the 
building, it is anticipated that there will be significant overlap in the contents. The availability of 
word processors and inexpensive high quality printers help to make this approach feasible. 


The same action document, with some minor variations, can probably be used for all tower 
occupants, because all will be using the same life safety strategy. Moreover, the plans for tower 
personnel can be so simple that the entire action document for fire emergencies can possibly fit on 
a single page of large print. This document should clearly state the life safety strategy (e.g., "If 
there is evidence of an actual fire, use stairs to leave tower. If stairs are unavailable, then use 
elevator.") Specific actions that are needed to implement the strategy should also be addressed, 
(e.g., how to investigate an alarm, where to report a fire, and the details of transferring control of 
the airspace). The contents of the plan may vary depending on the jobs of the building occupants. 
For example, the action document for those maintaining the electronic equipment would not need 
to include procedures for transferring control of planes to a different tower or to the TRACON. 


A common problem with all types of occupancies is that the action documents, if they exist at all, 
are not immediately available to building occupants. They may have been distributed, but people 
may not remember where they put them. Access to the action document should be immediate, and 
its location should be obvious. For example, posting the action plan by a fire alarm annunciator 
seems appropriate for many of the towers that we visited. 


C. Criticality of occupant knowledge about life safety systems. As a general rule, during an 


emergency, people will pursue a course of action that they believe is most likely to provide safety. 
A building may have fire protection features that support a certain life safety strategy, but if the 
building occupants are unaware of those features, they may be unwilling to follow the strategy. The 
use of elevators during fire emergencies is an excellent example of this problem. Later in this 
report, we discuss the reluctance of interviewed air traffic controllers to use elevators during an 
emergency. Without a fairly detailed understanding of the hardware features used to protect the 
elevators, we believe that many tower occupants may not follow the recommended strategy. 
Instead, they may endanger themselves needlessly by using stairs that have a dangerous amount of 
smoke, or by simply remaining in the tower hoping that the fire can be controlled and that they will 
be rescued. 


D. Training. To assure that the emergency plan is followed properly in a fire emergency, it is 
important to inform the building occupants about the plan and the total fire safety system. The 
occupants need to receive training. We do not envision formal training classes with large groups 
of students. The training can be less formal and more individualized. For example, individual air 
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traffic controllers could view instructional videos during non peak hours. Reading of the emergency 
plan would convey considerable information. Simulated fire drills would make the plan more 
understandable and help the participants remember the plan. Small groups could discuss what 
constitutes a fire that warrants an emergency evacuation. 


Topics that should be covered include: 


Characteristics of the new elevators that make them safe to use when there is a fire. 
Occupants need to understand that the presence of some smoke does not disallow elevator 
use or stair use. Some entry of smoke into the elevator lobbies or stairways is likely as 
occupants open and close doors, but a very limited amount of smoke will neither endanger 
occupants nor interfere with the operation of the elevator. 


Fire safety features of the building that make it unlikely that there will be a fire that 
becomes dangerous enough to require an evacuation. The training should include 
encouragement not to violate these fire safety features. 


Fire safety features that make it likely that, in the event of an evacuation, there will be a 
safe path to both the stairs and the elevator. 


Characteristics of the stairs that make it unlikely that they will be blocked. 


Characteristics of fire and fire growth. When people who are investigating smoke alarms 
or smoke odor discover a fire, they should be able to ascertain to some degree the extent 
to which the fire is an immediate threat. 


Procedures for safely investigating potential fires. Controllers need to know how to 
investigate locations where opening a door or using the elevator could endanger themselves 
or allow fire or smoke to spread to other locations. (For example, anyone investigating 
ambiguous signs of a fire should know to make sure the edge and knob of a door is cool 
before it is opened. Only if the door is cool should it be opened, and then, if the door 
opens toward the person, a shoulder should be braced against the door while it is opened 
just a little.) 


Procedures for transferring control of aircraft to other air traffic controllers. 


Assignment of responsibility for calling the fire department and upon their arrival informing 
them of the location of the fire. 


Procedures for determining the location of all building occupants during the evacuation and 
determining when all occupants have evacuated. Procedures for meeting the fire 
department upon their arrival and informing them of the need for rescue. 


Training in the use and limitations of portable fire extinguishers. 


FE. Need for elevators and other building equipment to be highly reliable. Air traffic control 


towers normally have only one elevator. In the elevator industry it is well known that buildings 
with only one elevator suffer from a high level of complaints due to “out-of-service" conditions. 
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People become annoyed when they cannot use the elevator and must climb the stairs, especially 
when the climb is long such as in an air traffic control tower. 


Our interviews with air traffic controllers clearly demonstrated that the perceived reliability of 
elevators has a strong effect on the controllers’ expressed willingness to use them during an 
emergency. In a few of the visited towers, we heard comments that there had been frequent 
problems with the elevators. For example, one tower was visited on a Monday morning, and the 
elevator had been repaired just prior to the visit after having been inoperable since Friday. Ina 
second tower the elevator was not operating smoothly (i.e., there was a very noticeable vibration) 
even though repairs had been completed several hours earlier. In the towers where we heard 
complaints about reliability problems, we noted that tower occupants were much more emphatic 
in expressing their reservations about using elevators during an emergency. Many of these 
controllers continued to lack confidence even after we described the types of features that could 
make elevators relatively fire-safe. In the other towers, controllers also expressed hesitation, but 
in a milder fashion. Most of these controllers seemed more willing to revise their views after our 
discussion of the safeguards that would be designed into fire-safe elevators. It follows that it is 
important to have elevators with a minimum of down time. Scheduled preventative maintenance 
should be well publicized in advance so that the down time is not interpreted as a sign of an 
unreliable elevator. 


It is reasonable to generalize that good general maintenance of the building will encourage people 
to trust a fire safe elevator system to provide a safe means of emergency egress. Similarly, 
occupants of a poorly maintained building are likely to hesitate using an elevator when their safety 
depends upon its reliability, even if the elevator itself has been generally reliable. Generalizing 
further, it is likely that the attention given to preparing and distributing fire safety plans and the 
effort given to explaining the fire safety features of the building to the occupants are likely to 
increase the occupants’ confidence in the elevator. As one General Services Administration official 
said to the authors during a related study, "We have to earn their trust.” 


Il. FACTORS AFFECTING ACCEPTANCE OF AND COMPLIANCE WITH THE 
EMERGENCY PLAN 


A. Recognition that current elevators should not be used in case of fire. For over twenty years 


the general public has been warned that they should not use elevators for evacuation in fire 
emergencies. Fire safety experts have been consistent in their universal agreement with this policy. 
Most buildings with elevators have signs to that effect near each elevator on each floor that is not 
at grade level. The average building occupant is well aware that he or she should not use the 
elevator if there is a fire in the building. All the FAA employees we interviewed knew they were 
not to use elevators during a fire. 


Actually the generally accepted strategy is a little more complicated. Many experts recommend that 
some occupants can and should use an elevator atter the fire department has determined that the 
elevator can be used safely. This would be a reasonable way of evacuating an occupant who has 
a disability that would make it impossible or very difficult for the occupant to use the stairs. 


If elevators that are safe to use for evacuation in fire emergencies are installed in aviation control 
towers, most air traffic controllers, technicians and others in the tower initially will be scared to use 
the elevators for fire evacuation. For the installation of such elevators to be a success, there is a 
need for an effective program to reassure the building occupants that the elevator is different from 
typical elevators, and is safe to use for evacuation in fire emergencies. Years of training not to use 
elevators during fires is surmountable. People can be taught that during fires they can use those 
elevators that have been specially designed for such use and to avoid other elevators during fires. 
But the problem must be addressed with a well designed training effort. See section on training 
on page 7. 


B. Impact of psychological control. People have strong psychological needs to exert some control 
over their own fate. This is a well known psychological need that was highlighted in an earlier 
study regarding the potential tor using elevators in fire evacuations (Groner and Levin, 1992, p. 31). 
As anticipated, in the interview sessions the controllers strongly preferred using the stairs to using 
an elevator during a fire emergency. In addition, they frequently expressed their concern that they 
would not want to use an elevator during a fire--even as a backup escape route--primarily because 
they did not want their safety to rely on the reliability of a mechanical system, i.e., an elevator. 
They were afraid of being trapped between floors. 


C. Confidence that fire safe elevator system can be installed and maintained. When we 
interviewed air traffic controllers and other FAA employees working in the towers, we encountered 


considerable skepticism about the likelihood that the system would really work as claimed. They 
expressed concern that the elevator evacuation system would not be maintained sufficiently 
rigorously for them to entrust their lives to it. They frequently pointed out that the current 
elevator in their tower is unreliable or in a poor state of repair. See discussion on need for 
elevators and other equipment to be highly reliable on page 8. 


D. Wait for the elevator. Air traffic control towers, in general, have a small number of people in 
the tower itself. There was an office area associated with each of the towers we studied. From a 
fire safety standpoint, most of these office areas would be considered as separate buildings--there 
was a good fire barrier (i.e., a two hour fire wall) between the tower and the office area. (The 
escape route of at least one tower includes passing through the office area--a consideration that 
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is beyond the scope of this report.) In most facilities, the occupants of the office area would not 
be competing for the limited capacity of the tower elevator. 


There are several factors that would affect the amount of time that tower occupants might be 
required to wait for an elevator if the stairs cannot be used safely. 


The capacity of the elevator compared to the number of tower occupants. Multiple trips 
most likely will be required because the single elevator may not have the capacity to hold 
all occupants of the tower at one time. If TRACON is in the tower, the elevator may need 
to make several round trips. (Klote, Levin and Groner, 1994, address the issue of minimum 
elevator capacity.) 


Varied arrival times at the elevator lobby. Some occupants would wish to start their 
descent on the elevator while others are undertaking actions to assure safe airspace during 
and after tower evacuation. 


The travel speed and acceleration of the elevator. 


Enroute stops. The elevator may stop at floors other than the one nearest the cab. 


E. Down time during scheduled and unplanned maintenance. Many towers operate 24 hours a 


day. Maintenance of elevators requires taking the elevator temporarily out of service during 
routine maintenance. Also, unanticipated problems can take the elevator out of service. 


If the fire safe elevator is required to meet fire safety requirements (e.g., to provide a required 
second escape route) a backup procedure might be needed to maintain the required level of safety 
during down time. Examples are: sounding of the fire alarm might result in "immediate" evacuation 
rather than investigation of the cause of the alarm; and special efforts to assure that doors to 
storage areas and equipment rooms are properly closed and stay closed. 


If the fire safe elevator is installed to provide a level of safety beyond that required, providing that 
increased safety for the vast majority of the time should be deemed sufficient and praiseworthy. 


F. Individual differences. While nearly all FAA employees interviewed expressed a strong 
preference for using stairways as the first choice escape route, there were considerable differences 
among those interviewed on how willingly they would use a fire safe elevator to escape fire and 
smoke in an FAA tower. A few would use it with little hesitation if the stairway was unavailable. 
Others would prefer to wait for possible helicopter rescue; to escape onto the catwalk, or to climb 
down outside ladders, if available. The majority indicated they would use the elevators if it were 
necessary with little delay but with considerable concern. 


G. Awareness of the nature of fire growth and smoke spread. Many of those interviewed indicated 
they would prefer to use the stairs even if it contained considerable smoke at the time they entered. 


Only one controller expressed a concern or fear of using a stairway with a modest amount of smoke 
because he anticipated that the smoke density might rapidly increase over time. A majority were 
only concerned with the nature of the smoke at the time of entry into the stairway. In planning 
fire escape routes one should anticipate that the smoke concentration will probably increase with 
time. The training program should give the employees guidance on this issue. 
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IV. COORDINATING AND DIRECTING THE EVACUATION 


A. Introduction. Large buildings often have a security force that would investigate smoke alarms, 
call the fire department (or activate a fire brigade), and initiate and direct the building evacuation. 
A location in the building is designated as the Command Center: it serves as the central point for 
communications and control during a fire or other emergency. Large and middle sized federal 
government buildings managed by the Government Services Administration are required to have 
a formal Occupant Emergency Plan. The plan assigns duties to members of the Occupant 
Emergency Organization. 


For most air traffic control towers, the approach described above is not feasible. The number of 
building occupants is too small. Nevertheless, all the functions of the command center and the 
Occupant Emergency Organization must be accomplished, albeit in a more informal manner. 


B. Automatic elevator control. While occupants of buildings are warned not to use elevators in 
fire emergencies, the elevators contain automatic controls to help assure their safe operation in fire 
emergencies if they are used contrary to these warnings. These automatic controls also help assure 
rapid availability of the elevators for use by the fire department. In short, once smoke is detected 
in an elevator lobby or in the elevator shaft, the current elevators return, with any occupants in the 
elevators, to a floor with easy access to the outside and easy access by the fire department. (If the 
safety of the primary destination is not assured, an alternate floor is used.) This is called "Phase 
I Emergency Recall Operation.” Firefighters can use a special key to override the automatic 
shutdown of the elevators and control the elevator using the control panel in the elevator. When 
firefighters or others operate the elevators after the automatic Phase I Emergency Recall 
Operation, it is called "Phase II Emergency In-Car Operation." These terms are often simply called 
Phase I and Phase II. 


Note that if there is no smoke in the elevator lobbies or the elevator shaft, the elevators operate 
in the normal mode. There is no reason to change this general approach if the elevator is designed 
for safe use during fire emergencies in air tratfic control towers. However, a modification is 
recommended below. 


Some entry of smoke into the elevator lobbies is likely as occupants open and close doors, but this 
limited amount of smoke will neither endanger occupants nor interfere with the safe operation of 
the elevator. Therefore, we recommend that the elevator should not automatically switch to Phase 
I Emergency Recall Operation until detection of a predetermined amount of smoke. The amount 
of smoke necessary to activate Phase I should be the subject of a separate study: the threshold for 
a given tower should be a function of the specific fire safety features of that tower. An alternate 
approach would be to use low threshold heat detectors to initiate Phase I. 


C. Operation of the elevator. During the evacuation, the elevator should operate in the non- 
emergency mode. It should respond to the call buttons and go to the floors selected on the control 
panel in the elevator. (When the elevator is in an emergency mode, it cannnot be operated by the 
tower occupants. ) 


There are two issues associated with the operation of a fire-protected elevator during an evacuation 


of an aviation control tower. First, should the elevator be routed in any special way after a fire is 
detected? Should the elevator contain any special emergency operational features for use by tower 
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occupants not in typical elevators in new office buildings? In both instances, we conclude that, in 
general, special features are probably not necessary. However, the criteria for initiating the Phase 
‘I Emergency Recall Operation (i.e., automatically returning the elevator to a preassigned floor) 
would need to be changed as discussed above. Also, we do suggest below one special control 
feature that should prove worthwhile. 


In our report covering the general issues of using elevators to evacuate a portion of the general 
population of office buildings (Groner and Levin, 1992), we devised some fairly elaborate sets of 
Strategies that might be appropriate to high rise buildings. These sets of strategies required that 
elevators be routed to floors on a priority basis based on the location of the fire and the presence 
of persons waiting to evacuate. However, the problem of evacuating control towers is much 
simpler. In most towers, there should be little need to prioritize the evacuation of occupants. 
Occupants needing evacuation generally would be concentrated in only a few locations, and the 
complete evacuation should require only a few trips over a relatively short period of time. 


We do not recommend redesigning the controls inside the elevator to give building occupants, 
escaping from air traffic control towers, additional control over the elevators in a fire emergency. 
Additional control, such as that provided fire fighters during Phase II, gives additional safety from 
hazardous conditions. However, the building fire protection features should prevent occupants 
from encountering hazardous conditions while in the elevator. During the evacuation, building 
occupants should have control of the elevator only when the elevator is safe. If the elevator should 
not continue to operate because of safety concerns, it is designed to relocate automatically and to 
Stay at a designated safe location (i.e., automatically go into Phase I). Further, as explained in the 
prior paragraph, we do not believe that there is much advantage to providing any special routing 
capabilities. Moreover, special emergency operational teatures would add significantly to the 
difficulty of training tower occupants. Therefore, special routing controls, such as a feature that 
allows evacuating tower occupants to cancel calls to specific floors, would be of little value. 


However, there might be some advantage in providing to occupants of air traffic control towers a 
few simple operational features that are currently provided to firefighters when they use elevators 
in fire emergencies. For example, when firefighters operate the elevator in Phase II, continuous 
pressure must be applied to a button to open the elevator door. In fire emergencies this feature 
might provide an increase in safety to tower occupants in the highly unlikely event that the other 
safety features fail to operate as designed. More important, such a feature would provide tower 
occupants with an added sense of control, thereby encouraging elevator use during a fire 
emergency. 


There might be some advantage for an unoccupied elevator to go to the highest floor so that 
workers in the cab might have a shorter wait. If this option is installed, it should not override the 
call buttons on other floors or the control panel in the elevator. 


If the elevator goes out of service because of smoke in an elevator lobby or shaft, it is not 
anticipated that FAA employees would reactivate the elevator with a key. It is anticipated that they 
would have neither the training nor the information necessary to safely undertake the task. 


D. Response to smoke detector and other alarms. Most alarms initiated by smoke detectors are 


false alarms. The sounding of such an alarm currently does not automatically initiate an evacuation 
of the tower. We anticipate no change to that practice. Each tower will develop its own 
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procedures for investigating the cause of the alarm and for disseminating the information. The 
decision to evacuate is a judgement call but usually the need to evacuate will be obvious. However, 
since fires may look rather innocuous just prior to a rapid growth stage where the fire may rapidly 
become a raging inferno, some limited training about fire growth is highly recommended for all 
workers in the towers (for example, a short training film). 


E. Decision to use the elevator. It is anticipated that the vast majority of the current workers in 
the towers would select the stairs as their first choice route for evacuation in a fire emergency. 
This was hypothesized prior to undertaking this study and was confirmed in the interviews. The 
decision to use the elevator, as opposed to the stairs, should be an individual decision by each 
building occupant. Again, some limited training about fire growth, smoke spread, and the toxicity 
and irritability of smoke should be given so that everyone will be aware of the dangers involved in 
going into a stairway containing smoke. 


There are several circumstances that might lead people in the towers to attempt to use the fire safe 
elevator in a fire emergency. 


The path to the stairs might be blocked when the path to the elevator is available. Given 
the small area of each floor and the high quality walls and doors, this is not likely to occur. 


The stairs can become filled with smoke. 


The person can have a disability that forces or encourages the choice of using the stairs. 
While the current FAA policy is not to hire controllers who have disabilities that prevent 
them from properly performing the normal tasks of controllers, some current or future 
controllers may have other types of disabilities that make rapidly descending a long stairway 
a difficult, unpleasant, or dangerous activity, e.g., arthritis of the knee. 


The person may prefer to use the elevator rather than the stairs. 


Based on our interviews of FAA employees who work in the towers and our observation of the 
towers and their contents, all of these are unlikely scenarios in a building that meets rigorous fire 
safety codes. However, fatal fires do occur in buildings where code-required fire protection 
features are installed--constant vigilance is needed to make sure that the fire safety features are not 
modified or by-passed and that the building occupants do not perform inappropriate actions. 
Relaxation of this vigilance is always possible. 


F. Control center and communication. For large structures or building complexes, control centers 
are often dedicated rooms. These rooms usually contain the communications and monitoring 
equipment needed to coordinate an evacuation and fire control activities. Most new air traffic 
control towers, and associated buildings for offices and equipment, are independent and separated 
from other parts of the airport. The number of building occupants is likely to be too small to 
justify equipping and manning a dedicated control center. (Some existing towers are part of the 
terminal building. In these instances, it may be desirable to coordinate emergency activities in the 
tower with activities in the terminal, in which case, a single control center would be preferred.) 


Although a dedicated control room is unnecessary, the functions performed at a control center still 
need to be addressed. 
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We recommend that fire protection system annunciator panels and communications equipment be 
placed at a single location that is readily accessible to arriving fire fighters. This location should 
be exterior to the tower so that it could continue to be used during a serious fire. Appropriate sites 
are Outside the tower near the exit, and in an adjacent support building. (Towers are constructed 
so that from a fire safety standpoint, the office area adjoining the tower is considered a separate 
building.) 


It is preferable that the selected site have a view of the tower and its exit discharge. The site 
should be equipped with a fire alarm system annunciator that provides information about alarm, 
supervisory and trouble signals. The annunciator panel is used by the responding fire department 
to locate any activated smoke detectors or manual fire alarm boxes. Other annunciator panels or 
similar equipment that provide information about the status of smoke control and fire sprinkler 
systems are best placed at the same location, if at that location the status of the system will be 
frequently checked and auditory signals heard. | 


In addition to the fire alarm annunciator installed at a site not in the tower, we also recommend 
that an annunciator be installed in the cab. (We observed such installations in the some of the 
towers we visited.) Air traffic controllers need to be automatically informed of the location of 
activated detectors so that they can respond as appropriately and quickly as possible. Such 
information can be critical when the tower and associated support space is occupied only by air 
traffic controllers. 


Communications between the central control site and locations inside the tower can be critical 
during a fire incident. Usually, the need for two-way communications can be most easily satisfied 
by an appropriately designed telephone system with associated emergency procedures. In designing 
the telephone system it is important that two rather obvious requirements be met. The telephone 
system should be protected from fire. The alarm system should not sound in a way that it unduly 
interferes with the use of the phone: for example, the alarm could sound intermittently and still 
meet the need for the alarm to sound throughout the fire emergency. 


The telephone system may be used by the tower occupants for any of the following purposes: 1. 
to summon assistance; 2. to receive important information or instructions from the control site or 
other remote location; 3. to report their locations and conditions encountered to emergency 
personnel; 4. to arrange for other air traffic control facilities to assume control of airspace as an 
alternative to radio communications; and, 5. to communicate among themselves. The 
communications system can also be used by emergency personnel to locate and instruct persons 
occupying the tower. 


Emergency phones are generally required in elevators. (Emergency phones often lack handsets, 
instead using speakers and microphones to allow handsfree operation and communications with 
more than one person in the elevator.) Ifthe use of elevators is part of the fire emergency plan, 
emergency phones are also needed in the protected elevator lobbies, since persons may become 
stuck in the lobbies without access to the elevator car. A direct dialing feature for these emergency 
phones will help ensure that persons in elevators and elevator lobbies can easily summon assistance. 
In addition to providing communications with an exterior control site, these emergency phones 
should directly dial a remote location that is always manned (for example, an airport security 
station or fire station) when the tower and adjacent support buildings are occupied by only a few 
controllers. 


if: 


V. CARRYING OUT THE EVACUATION 


A. Information needs of tower occupants. Initially, fire emergencies are often ambiguous events. 
Rarely do the first signs of trouble clearly indicate that an evacuation is needed. Most smoke 
detector activations are false alarms in air traffic control towers and in other occupancies. The 
faint smell of smoke does not necessarily mean a significant fire. Ambiguous signs of a problem 
are usually investigated before an evacuation is ordered. The sooner that a fire is verified and the 
tower occupants notified, the more time that they will have to complete the life safety strategy 
before the fire grows from a threat to a danger. For this reason, it is important that persons in the 
cab be notified of a potential problem at the earliest possible time, and that the situation be 
accurately assessed as efficiently, quickly, and safely as possible. Verifying a fire may become less 
straightforward during periods of light statfing--there may not be sufficient manpower to conduct 
a rapid search and still maintain control over flight operations from the tower. For example, at one 
tower, staffing after midnight was one controller at TRACON and one in the cab. 


We offer the following recommendations for any tower emergency plan, regardless of whether 
elevators play a role in the life safety strategy. 


A fire alarm annunciator in the cab is essential to provide controllers with the maximum 
amount of information at the earliest possible time when there may be a fire. (We did 
observe annunciators in cabs.) 


A policy and procedure is needed for investigating alarms, especially when the rest of the 
tower is unoccupied and controllers cannot conveniently be made available to investigate. 


A policy is needed for actions to undertake during any period when it appears an 
evacuation may be needed but not yet necessary. This is a period when an orderly transfer 
of control of airspace might be initiated. 


There are other information needs specifically related to emergency egress using an elevator. 
Specifically, occupants must know the exact status of the elevator. If the elevator is unavailable 
for any reason, then occupants will need to take appropriate action. For example, an occupant 
following the strategy of: "Use stairs to leave tower. If stairs unavailable, then use elevator," will 
either nced to take refuge (perhaps in the elevator lobby) until he or she can be rescued or attempt 
to travel down the stairs even though that approach had been initially rejected. In any event, the 
occupant should know not to wait for an elevator that will not arrive. A possible means for 
providing this crucial information would be to install signage in the elevator lobby that would 
indicate the operational status of the elevator. For example, the elevator system might include 
illuminated messages in the elevator lobbies that read, "elevator in normal service," "elevator 
out-of-service," or "elevator in emergency service" depending on the operational mode. (Tower 
occupants would need to be instructed on the meaning of these terms as part of their fire safety 
training.) 


B. Time required to transter control. To safeguard the safety of the aircraft under their control, 
air traffic controllers must decide whether and how to transfer control of at least some planes 
before evacuating the cab. This procedure would increase the time required to complete the life 
safety strategy. During our interviews, we explored this issue with air traffic controllers by asking 
them to describe what needed to be done before leaving the cab and how much time it would take. 
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The responses of controllers varied widely. Their responses differed considerably on the minimum 
time they needed before they could leave the cab. The shortest time estimate was about 30 
seconds. This controller said that a blanket call to all approaching planes was sufficient, that the 
pilots on short and final approaches would be able to land without further assistance, and that 
other planes could contact TRACON or a nearby tower. Other controllers anticipated that they 
would notity the appropriate TRACON that they were evacuating the tower and that their planes 
needed to be contacted in addition to the blanket call. Some controllers believed that there are 
situations when it is necessary to contact some aircraft individually to maintain adequate safety 
prior to evacuation. Some controllers stated that if continued contact needed to be maintained 
with aircraft, a transceiver in the cab could be taken along and used from the ground outside the 
tower. 


Some of the emergency plans reviewed by the authors covered emergency procedures. However, 
the procedures were typically very general (e.g., "Notify adjacent facilities of significant service 
disruptions").* 


Most estimates of delays were from 1.5 to 5 minutes. One controller pointed out that poor 
visibility would delay their evacuation somewhat. A few controllers estimated longer delays before 
they could leave the tower--as long as 10 minutes. However, these controllers were fairly vague 
about what they would need to do during this extended period of time. They appeared to feel that 
at least some of the planes would need to be contacted individually and followed until such time 
as the plane could safely land or control has been successfully passed to another tower or to the 
associated TRACON. It is beyond our scope of work to determine what needs to be done before 
leaving the cab in an emergency, and how long it would take. However, if the more lengthy time 
estimates are accurate, that is, if controllers might delay their evacuations for more than a few 
minutes, then the potential delay would be significant and conceivably life threatening to the 
occupants of both the tower and aircraft under its control. In this instance, it would probably be 
worthwhile to study the situation to determine the minimum actions that need to be taken without 
endangering aircraft, and how those actions could be completed in as short a time frame as possible 
by establishing and training controllers in a specific protocol. Based on our discussions with the 
controllers, we believe that it is unlikely that a long delay time is necessary. If this conclusion is 
proven to be wrong, then it should be determined if the current code, and the upgrades beyond the 
code installed by the FAA, provide satisfactory protection for the total evacuation time, including 
the lengthy delay. 


* One controller provided interesting insight into the delay problem and the need for detailed 
emergency protocols. He was present in a control tower during a strong earthquake. Even without 
a protocol for handling the emergency, the controllers believed they had handled the emergency 
efficiently without much difficulty. (Of course, his recall of the event may not necessarily be a 
precise portrayal of what really happened.) He said that it was fairly obvious how to respond. 
Only planes on a final approach needed to be immediately handled--they needed to abort their 
landing pending a check on the condition of the runways. Afterwards, other planes were directed 
into holding patterns while possible damage to the runways was surveyed. After it was determined 
that only one runway had sustained damage, the planes were directed to the alternate runways at 
this airport or to other airports. He felt that the lack of formal protocols for handling working 
planes did not present much of a hazard. The controllers understood their job well-enough to 
prioritize their tasks so that only critical tasks received attention in this life threatening situation. 
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C. Delays in evacuating TRACON. For the towers that housed a TRACON, the controllers 
estimated that it would definitely take longer to leave these posts than to leave the cab--one 
controller estimated 10 minutes. Again, this estimate of a ten minute delay warrants study as to 
its accuracy and how the time delay could be shortened. Conceptually, the effect of the delay on 
fire safety is the same as in the cab. However, the operations in TRACON are sufficiently different 
from the operations in the cab that conclusions regarding the cab cannot be generalized to 
TRACON. 
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